Microsoft Windows

Other than commonly using the Windows Task Manager to end a hung task or process, it is also very useful to quickly check the active running programs on your computer. You may noticed that there is quite a number of svchost.exe listed in the processes tab and is probably wondering what is it and how come there are so many of them running? Basically SVCHOST is used by Windows to run multiple Windows services and the reason why Windows services uses svchost.exe to run is because they are in DLL files and not an independent executable (.EXE) file. If you didn’t know, Windows Services is one of the startup method in Windows where it can automatically run in background without even requiring the user to login to their account in Windows, unlike other startup method where the programs will only run when the user is logged in to Windows.

Normally users would ignore the existence of svchost.exe listed in the Windows Task Manager and only look for some dubious image name. This is where some malware takes advantage by using the file name as svchost.exe, hoping that you would not notice its presence. One easy way to find out a suspicious svchost.exe is by looking at the user name that is used to run the svchost.exe. If the svchost is ran by SYSTEM, NETWORK SERVICE or LOCAL SERVICE, then it should be legitimate but if it is ran under YOUR user account, then you need to investigate if the svchost.exe file is from another location than C:\Windows\System32\. If you’d like to identify the services that are ran behind the svchost.exe, here are 7 ways to do it. 1. Windows Task Manager

Starting from Windows Vista, Microsoft has made it easy because the Task Manager is capable of showing you the service name associated with the svchost.exe process. To run windows Task Manager, right click on the task bar and select “Start Task Manager”. Alternatively you can also simultaneously press Ctrl+Shift+Esc. Then all you need to do is right click on the svchost.exe process and select “Go to Service(s)” where you will automatically jump to the Services tab and the service name being highlight.

You are able to start or stop the service by right clicking on the service name. The problem is, some virus disables the Windows Task Manager by changing a registry value and it is important to know other methods of identifying the svchost.exe service name.

2. Command Prompt

Another method to reveal the service that is associated with the svchost.exe is by using tasklist.exe from command prompt. In command prompt, type the command below, hit enter and the service name will be displayed at the right side of the tasklist output.

tasklist /svc /fi “IMAGENAME eq svchost.exe”

There are some limitations in using the tasklist.exe command line tool because it only the cryptic service name, not the display name or description. Just like Task Manager, command prompt too can be disabled from running by malware which is why sometimes it is good to have third party tools in hand.

3. Process Explorer

Process Explorer is the grandfather of all task managers. So far it seems to be the most comprehensive tool to control and view the information associated with svchost.exe. Simply double click on the svchost.exe in Process Explorer and click on the Services tab.

First you get to see all the services registered in the process that you’re viewing, then it shows the service name, display name and the path to do DLL file that was loaded. You are also able to configure the permissions for the service plus stopping, restarting, pausing and resuming the service.

Process Hacker is another popular free and powerful open source task manager that is capable of showing and controlling the services from svchosts.exe process. Just like Process Explorer, double click on svchost.exe process and go to the Services tab. The list of associates services is shown and you can stop or pause the service. Double clicking on the service will bring up a more advanced property window to configure the permissions, startup type, error control and many more.

There are both installer and portable versions available including 32-bit and 64-bit builds.

Svchost Process Analyzer is a free and portable program that analyzes the svchost.exe and shows services that is associated with the process. Clicking on any ID on the top window will display the services at the bottom together with the DLL file and status. The description of the service will automatically refresh and shown at the top bar of the program. This tool can only display information but lack of control options.

Svchost Viewer is another free and open source utility hosted at CodePlex that gives you the basic information such as service name and description. There are also two checkboxes to show if the service can be paused or stopped. If it can be stopped, click on the Service Control menu bar and select “Stop Selected Service”. A piece of interesting information shown in Svchost Viewer is the amount of data written and read.

Services In Svchost is a very simple program that simply shows the services in the svchosts.exe. There is no description, no control, or DLL file information. The only unique feature found in this utility is the ability to view the services on remote computers by entering the computer name or IP address.

There are requirements if you want to get the services on remote computer. Firstly it requires a user account that has a password set (empty password is not allowed) and the Remote Registry service must be manually started. Make sure the Windows Firewall is not blocking the connection. Once all this 3 requirements are met, you need to manually authenticate with the remote computer by accessing the shared folders. After authentication, simply enter the computer name and click Get Services button.

Logical drives

The Win32_LogicalDisk WMI class represents a data source that resolves to an actual local storage device on a computer system running Windows. While Caption, Description, DriveType, ProviderName, and VolumeName are useful in most cases, more properties are available, and a complete list is available at http://msdn.microsoft.com/en-us/library/windows/desktop/aa394173(v=vs.85).aspx. The output will be formatted as a table, the properties will be the column headings, and they will be placed into alphabetical order.

Caption is the drive letter of the logical disk. The Name property also returns the drive letter.

Description is the type of disk. For example: Local Fixed Disk, CD-ROM Disc, or Removable Disk.

DriveType is returned as an integer that corresponds to the type of disk drive the logical disk represents (and this matches the Description, making DriveType sort of superfluous).

Shutdown or Wake Up a PC on a LAN

In addition to serving as a host, a LAN (or local area network) also gives users a certain amount of control over the PCs that are connected to a network. Included in this is the ability to turn a computer on or off from a remote location.

This article will explain how to use the Shutdown command to turn off a computer remotely as well as how to use the WakeOnLan standard to wake or boot a PC.

Remotely Shutdown a Computer on a LAN

In order to control a computer remotely, please note that you must be connected to the same local network as the target PC. You must also know the username and password required for login.

The first step is to open TCP port 445 on the target computer. To do this, open your Start menu and then go to Settings > Control Panel > Security Center.

Open Windows Firewall and click the Exceptions tab.

Select the line that reads File Sharing and printers and press OK. If this line is missing, click Add Port and choose TCP port 445 .

Next, head to Start > Settings > Control Panel > System. Select the Remote tab and check the option that reads Allow users to connect remotely to this computer.

It is now time to open the command prompt.

Head to Start/Run or use the keyboard shortcut Windows + R. Next, type cmd and then hit OK. This will open your command prompt.

To obtain the necessary rights to run a shutdown command on the target machine, you must first run the net use command. Use the Windows + R keyboard shortcut and then enter net use \\ip_address_of_target_machine. Enter an administrator username and password for the target computer to connect to the target PC.

Once connected to the target PC, we can run the shutdown command. An example of the command is given below, whereby instructions are given for the target computer to close all active applications and shutdown after 30 seconds of inactivity. Please note that you can substitute any of the variables according to your network or PC specifics:

shutdown -s -f -t 30 - m \\192.168.3.4

-s: Shutdown the PC

-f: Force active applications to close without warning

-t xx: Set a countdown in seconds

-m \\xxx.xxx.xxx.xxx: The IP address of the target computer

The GUI is available by typing shutdown -i.

For any additional information about this command, type shutdown /?.

The WakeOnLAN Command

WakeOnLAN, as the name already suggests, is a tool that can boot or wake a computer by sending a Magic Packet to the network adapter of the target computer. It is important to note that not all network cards and BIOS are compatible with, or support, the use of Magic Packet.

In order to use the WakeOnLAN command, you must be connected to the same local area network (LAN) as the target computer. Knowledge of the physical location (MAC) and IP address of the target computer is also required.

Retrieve IP and MAC Address

The first step is to retrieve the IP address and MAC address of the target computer. To do this, go to Start/Run or use the keyboard shortcutWindows + R and type cmd > OK.

The command prompt will open. Now type ipconfig /all:

Copy the IP and physical (MAC) address of the target PC.

Compatibility Checks

It’s now time to check if your network card is compatible with Magic Packets. To do this, right-click on My Computer and click Manage. Next, go to Device Manager/Network Cards and do a right-click on your Network Card. Then click Properties.

Do a search for the following words and verify that all options that relate to them are currently active: Magic Packet, Wake On Magic Packet, Wake On Lan, or Wake. If none of these words appear, you may be required to update the drivers for your Network Card.

To see if your computer is BIOS compatible, enter the BIOS when you start the computer. You can do this by pressing ESC, F2, F5, F12 or DEL (depending on your system).

Once in the BIOS, go Power Options and enable Wake-On-LAN, or any similar option:

Open Port 8900

You can open Port 8900 in the same way as you would Port 445.

Wake On LAN (WOL)

Start by downloading the Symantec WOL tool on the source computer. Launch the tool and then fill in the empty fields using the information gathered above.

If you want to give the impression that you’ve been using Windows 10 for years, learning a few keyboard shortcuts is the best way to go about it—you can navigate around the interface, get apps in position, trigger events, change settings and more with a couple of taps on your keyboard. Here are the shortcuts we’ve been finding most useful.

Window snapping

Window snapping has changed slightly in Windows 10 and so have the shortcuts. App windows can be snapped to either side of the screen, as in Windows 8, but you can also assign them to quadrants and get four windows open on screen simultaneously.

Windows Key+Left — snap active window to the left.

Windows Key+Right — snap active window to the right.

Windows Key+Up — snap the active window to the top.

Windows Key+Down — snap the active window to the bottom.

Bonus: Whenever you snap a window to a side or a quadrant, Windows will automatically suggest you pick one of your open apps to fill the remaining real estate on your desktop.

Virtual desktops

Official support for virtual desktops is one of the most exciting new additions in Windows 10—unless you’ve been developing a third-party utility to do the same job! It’s kind of like having extra invisible monitors. Each desktop can have its own set of apps but shortcuts and wallpaper are consistent across the board.

Cortana and settings

As you’ll know by now, Cortana has arrived on the desktop. If you don’t feel entirely comfortable shouting out “hey Cortana!” across a crowded room, then there are keyboard shortcuts that can help—once Cortana is active, you can choice voice or keyboard input.

Windows Key+Q — open up Cortana ready for voice input.

Windows Key+S — open up Cortana ready for typed input.

Windows Key+I — open up the Windows 10 settings pane.

Windows Key+A — open up Windows 10 notifications (Action Center).

Windows Key+X — open the Start button context menu (the one with easy access to a host of common computer management features—like the Command Prompt below).

Command prompt

The new Windows 10 command prompt gets new keyboard shortcuts as well. To use them, right-click on the command prompt title bar and choose Properties. On the Options tab, untick Use legacy console and enable Ctrl key shortcuts as well as the two text selection options.

Shift+Left — highlight text to the left of the cursor.

Shift+Right — highlight text to the left of the cursor.

Ctrl+Shift+Left (or Right)— highlight blocks of text instead of just characters at a time.

Ctrl+C — copy selected text to the Windows clipboard.

Ctrl+V — paste text from the Windows clipboard into command prompt.

Ctrl+A — select all text after the prompt.

These work in other text-based applications as well, but they’re new to Command Prompt.

Finding your way around

Besides all the new Windows 10 keyboard shortcuts, there are plenty of old classics that have survived successive versions of the operating system and are still going strong. Here are the combinations you’re going to need to navigate around the interface.

Windows Key+Any Number Key — open the app pinned to the taskbar in the numbered position (e.g. Win+2 launches the app in your second taskbar slot)

Going deeper into Windows

Unlock parts of Windows you never knew existed: Here are the shortcuts you need if you want to go way beyond the surface of the software into settings and options that would otherwise be difficult to find. Don’t click on anything unless you know what you’re doing.

Ctrl+Shift+Esc — open the Windows 10 Task Manager.

Windows Key+R — open the Run dialog box.

Shift+Delete — delete files without sending them to the Recycle Bin.

Alt+Enter — show the properties of the currently selected file.

Windows Key+U — open the Ease of Access Center.

Windows Key+Space — switch input language and keyboard.

Windows Key+Shift+Any Number Key — launch a new instance of the app in the numbered taskbar slot

Pictures, video and display

As you would expect, Windows 10 is a very visual OS and there are keyboard shortcuts to help you capture screenshots, record on-screen activity and zoom in and out. Note that to use theGame DVR recorder app you’re going to need a decent graphics setup installed.